1---2name: pc-style-supply-chain-guard-supply-chain-guard3description: Supply Chain Guard4---56# Supply Chain Guard78This project uses [Supply Chain Guard](https://scguard.pcstyle.dev/) to review packages before they are installed.910Install this skill with:1112```sh13npx skills add pc-style/supply-chain-guard --skill supply-chain-guard -y14```1516Or: `scguard skill install`1718## Rules for coding agents19201. **Do not** run `bun add`, `bun install`, `npm install`, `pnpm add`, `yarn add`, or `code --install-extension` unless the user explicitly bypasses scguard.212. **Prefer** `scguard review <package[@version]>` to download and analyze without installing.223. **Use** `scguard install <package[@version]>` when the dependency should be added after the gate passes.234. **Assume** exit code `1` from `scguard review` means high-risk findings — do not bypass unless the user explicitly requests it.245. **Run** `scguard doctor` when installs fail unexpectedly (missing shell hook, Socket token, or agent CLIs).2526## Common commands2728```sh29scguard review axios30scguard install lodash --dev31scguard scan-vsix ./extension.vsix32scguard doctor33eval "$(scguard shell-hook)" # optional: guard normal PM commands in the shell34```3536---37> Source: [pc-style/supply-chain-guard](https://github.com/pc-style/supply-chain-guard) — distributed by [TomeVault](https://tomevault.io).38<!-- tomevault:4.0:skill_md:2026-06-19 -->
Run npx skillmds@latest add tomevault-io/pc-style-supply-chain-guard-supply-chain-guard in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Supply Chain Guard It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.
tomevault-io